Tuesday, February 10, 2009

Valentine's Day is only four days away, which means its time for the Valentine's Day Spam CountDown! If you haven't decided what to give your special loved one yet for Valentine's Day, the spammers have plenty of suggestions.

On day T-4, here's what we're seeing for Valentine's Day at the UAB Spam Data Mine.

Number One - Our most popular Valentine's Day spam is using a spam template to randomize a subject line consisting of a salutation followed by a term for Valentine's Day. So, subjects look like these:

We also have copies of all the same "salutations" where "Valentine's Day" has been replaced with "The day of Love", with "02/14", with "14 Feb" and with "February 14" "14 Hearts" and "Februray month of Love" (yes FebRUray). We've received the complete collection of every salutation with every term, which I'm sure makes you jealous that the spammers like us more than you.

To complete the randomization, the spammer then includes a suggestion of why we should follow their link:

Attract that special someone this Valentine's DayBe a Valentine's Day stud!Don't be alone for Valentine's Day this year!Make this Valentine's Day the most memorable everTime to prepare for Valentine's Day.. be ready!

Followed by a randomly selected Chinese domain to see their Valentine's Day suggestion:

All of them are actually showing exactly the same content, hosted on the same server owned by Yurekeji Limited Company, that's right, in CHINA.

All of the webpages are for Sexy Kat's blog, who wants you to join her "free" service - you just need to share your credit card number with her to prove that you're 18 years old. The membership is supposed to be to "TubeScrew", but guess what? Sexy Kat's account has been terminated for spamming! (I wonder how that happened?)

Number Four - Finally some traditional Valentine's Day gifts! What could be wrong with Flowers for Valentine's Day?

The subjects advertise: Valentines Day Flowers Starting at $19.99 ProFlowers

We have a couple versions. The first one sends us to the website "residualincometruth.com" (69.65.54.9) (I guess the Truth about the Residual Income is that you can send spam for money, but you should keep your day job.) That website uses the code "oymnbdpmpvmq/ttnm/" to forward us to a different website, "www.bestwhole.com" (72.32.107.97), which uses another code "NjU0MnwxNTI0fDE5Njg0Mnx2Mg" to forward us to another website "lnkflw.com" (67.208.131.106) which does a redirect to send us to the actual website, http://products.proflowers.com/.

The other one that I tracked from them sent me to the website "gqv.getcitynews.com" which sent me back to "bestwhole.com" which sent me to lnkflw.com which sent me to proflowers.com.

It should be noted that in both of the above ProFlowers ads, they were not engaging in spam, according to the CanSpam Act, because they have provided the true mailing address of their company in the body of the email, and provided links in all the spam I received to allow me to click to no longer receive their emails.

The one I received from Motleygems.net, which also goes to ProFlowers, is NOT CAN-SPAM compliant, giving neither an unsub opportunity, nor a true mailing address. In that one the address at motleygems.net (69.30.253.178) forwarded to cpctrack.com, which forwarded to ProFlowers.com.

We also received this spam with links to "televisionlisting.net", "recognizedsources.net", "profitsforu.net", "tennesseewireless.net", "insiderstore.net", "eastprovidenceschools.com", "seriouszilly.com".

ProFlowers.com has beautiful flowers. Its too bad I don't buy things advertised by spammers. I'll have to just use Homewood Florists again like the old fashioned people.

The 1-800-Flowers.com spam I received was also CAN-SPAM compliant, with both a mailing address and an unsub address. That one sent me to the website "ct.silvermail-usa.com", which forwarded me to their website.

Number Five - Those thoughtful people selling Acai Berry weight loss solutions knew that I needed to lose a couple pounds for Valentine's Day, so that sent me a ton of spam with subjects like these:

Attract that special someone this Valentine's DayBe a Valentine's Day stud!Don't be alone for Valentine's Day this year!Make this Valentine's Day the most memorable everTime to prepare for Valentine's Day.. be ready!

In this case many different spammers all use the same domain name:

laneslow.com

by modifying it with their affiliate codes, like http://wyfyda.laneslow.com/?ufapqi or http://d.laneslow.com/?elcq or http://ntxynk.laneslow.com/?mmo

We'll have more Valentine's Day spam before the 14th I'm sure. Today's batch was rounded out with advertisements for Shoes, Watches, Cash4Gold, Airline Tickets, Rental Cars, Match.com and eHarmony, and the Slim 365 pill. But each of those was in low volume, so we'll let them slide for now.